Only POST Form widgets send a session token.

lib/form.php

@@ -91,8 +91,10 @@ class Form extends Widget
 
     function sessionToken()
     {
+        if (strtolower($this->method()) == 'post') {
             $this->out->hidden('token-' . $this->id() ?: common_random_hexstr(3), common_session_token(), 'token');
         }
+    }
 
     /**
      * Name of the form

lib/searchform.php

@@ -106,9 +106,4 @@ class SearchForm extends Form
     {
         return 'get';
     }
-
-    function sessionToken()
-    {
-        return;
-    }
 }